5ef56d7143003c33c09dcb6cfabed7ee96031efa91c9a5273d19ce125a430519

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 06:55

Target

3040-55-0x0000000000180000-0x000000000018E000-memory.dll
Size

56KB
MD5

d47b7db6142c3a39f017637338c67be0
SHA1

28b88b5b0f59e4e5b9c9bb8710d7059778d14ce7
SHA256

5ef56d7143003c33c09dcb6cfabed7ee96031efa91c9a5273d19ce125a430519
SHA512

64665bf0c8916ae1958be37ad3be24c81e0e45c733b60eb3d0bb0bff1a63f7e0bc2e35d6ff3ea4bfccccc24e5b7b61c2b6c112bec81d6c3eba83788798830d87
SSDEEP

768:A2GElOP0uEfnJRPBfxeNvsyuR4LNaX+jN43XepE9sc2MW/vYF68lU/w3DZcHy:oE4/EfnJRZZeS3V0ecfcWvYEOU/UDG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2236 2200 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2236	2200	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2100 wrote to memory of 2200	2100	rundll32.exe	rundll32.exe
PID 2200 wrote to memory of 2236	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2236	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2236	2200	rundll32.exe	WerFault.exe
PID 2200 wrote to memory of 2236	2200	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3040-55-0x0000000000180000-0x000000000018E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3040-55-0x0000000000180000-0x000000000018E000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 196
3⤵
- Program crash
PID:2236